Interpretation Conflict in GitLab Enterprise Edition and Gitlab Community Edition - CVE-2025-12506
Published: July 8, 2026
Vulnerability identifier: #VU137128
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-12506
CWE-ID: CWE-436
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause the web interface to display content that differs from the content available for download.
The vulnerability exists due to improper handling of Git reference name resolution in tag or branch reference handling when resolving Git reference names. A remote user can create a repository with ambiguous references to cause the web interface to display content that differs from the content available for download.
User interaction is required to rely on the web interface content.
Affected software
GitLab Enterprise Edition
Gitlab Community Edition
Gitlab Community Edition
How to mitigate CVE-2025-12506
Install security update from vendor's website.
GitLab Enterprise Edition - addressed in versions 18.11.7, 19.0.4, 19.1.2
Gitlab Community Edition - addressed in versions 18.11.7, 19.0.4, 19.1.2
Gitlab Community Edition - addressed in versions 18.11.7, 19.0.4, 19.1.2